Adware.Egame.928

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Egame.1

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.2) 1####.250.179.174:443
TCP(TLS/1.2) 1####.217.168.195:443

DNS requests:

1.cn.p####.####.org
and####.google####.com
av1.x####.com
i####.cn
id1.cn.8.####.8
m####.go####.com
p####.google####.com
safebro####.google####.com
www.google####.com

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.sdk.lck
/data/data/####/GoogleBackupTransport.dex
/data/data/####/GoogleBackupTransport.dex.flock (deleted)
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/apkInfo
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/cn_egame_openapi_opt.xml
/data/data/####/gameInfo.xml
/data/data/####/kxqpplatform2.dex
/data/data/####/kxqpplatform2.dex.flock (deleted)
/data/data/####/kxqpplatform2.jar
/data/data/####/kxqpplatform2.jar.lock
/data/data/####/lb_amcfg
/data/data/####/lb_packages
/data/data/####/libexecloader.so
/data/data/####/libjiagu.so
/data/data/####/libkxqpplatform.sinfo
/data/data/####/libzvmhelper.so
/data/data/####/main.dex
/data/data/####/main.dex.flock (deleted)
/data/data/####/main.jar
/data/data/####/platform.xml
/data/data/####/proc_auxv
/data/data/####/sdk_load_info.xml
/data/data/####/sig_0.key
/data/data/####/talkingdata_app_process_preferences_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tmp103549427tmp
/data/data/####/tmp103549427tmp (deleted)
/data/data/####/tmp1050665084tmp
/data/data/####/tmp1050665084tmp (deleted)
/data/data/####/tmp1055514047tmp
/data/data/####/tmp1055514047tmp (deleted)
/data/data/####/tmp1058232439tmp
/data/data/####/tmp1058232439tmp (deleted)
/data/data/####/tmp1076746972tmp
/data/data/####/tmp1076746972tmp (deleted)
/data/data/####/tmp1081368844tmp
/data/data/####/tmp1081368844tmp (deleted)
/data/data/####/tmp1085705528tmp
/data/data/####/tmp1085705528tmp (deleted)
/data/data/####/tmp1091967135tmp
/data/data/####/tmp1091967135tmp (deleted)
/data/data/####/tmp1196919396tmp
/data/data/####/tmp1196919396tmp (deleted)
/data/data/####/tmp1232635110tmp
/data/data/####/tmp1232635110tmp (deleted)
/data/data/####/tmp1243133987tmp
/data/data/####/tmp1243133987tmp (deleted)
/data/data/####/tmp1276572214tmp
/data/data/####/tmp1282423904tmp
/data/data/####/tmp1282423904tmp (deleted)
/data/data/####/tmp1294458438tmp
/data/data/####/tmp1294458438tmp (deleted)
/data/data/####/tmp1300355807tmp
/data/data/####/tmp1300355807tmp (deleted)
/data/data/####/tmp1303122871tmp (deleted)
/data/data/####/tmp1314865454tmp
/data/data/####/tmp1314865454tmp (deleted)
/data/data/####/tmp1329251581tmp
/data/data/####/tmp1329251581tmp (deleted)
/data/data/####/tmp1370271839tmp
/data/data/####/tmp1370271839tmp (deleted)
/data/data/####/tmp1374547506tmp
/data/data/####/tmp1375201250tmp
/data/data/####/tmp1375201250tmp (deleted)
/data/data/####/tmp1383099137tmp
/data/data/####/tmp1383099137tmp (deleted)
/data/data/####/tmp1417776024tmp
/data/data/####/tmp1417776024tmp (deleted)
/data/data/####/tmp1437026886tmp
/data/data/####/tmp1437026886tmp (deleted)
/data/data/####/tmp1456694393tmp
/data/data/####/tmp1456694393tmp (deleted)
/data/data/####/tmp1458420837tmp (deleted)
/data/data/####/tmp1458807372tmp
/data/data/####/tmp1458807372tmp (deleted)
/data/data/####/tmp148978457tmp
/data/data/####/tmp148978457tmp (deleted)
/data/data/####/tmp149353766tmp
/data/data/####/tmp149353766tmp (deleted)
/data/data/####/tmp1497667154tmp
/data/data/####/tmp1497667154tmp (deleted)
/data/data/####/tmp1511762202tmp
/data/data/####/tmp1513057110tmp
/data/data/####/tmp1513057110tmp (deleted)
/data/data/####/tmp1518074608tmp
/data/data/####/tmp1536158024tmp (deleted)
/data/data/####/tmp1573563457tmp
/data/data/####/tmp1573563457tmp (deleted)
/data/data/####/tmp1580219601tmp
/data/data/####/tmp1580219601tmp (deleted)
/data/data/####/tmp1585626424tmp
/data/data/####/tmp1585626424tmp (deleted)
/data/data/####/tmp1586818173tmp
/data/data/####/tmp1586818173tmp (deleted)
/data/data/####/tmp1624970244tmp
/data/data/####/tmp1624970244tmp (deleted)
/data/data/####/tmp1631498474tmp
/data/data/####/tmp1631498474tmp (deleted)
/data/data/####/tmp1661904884tmp
/data/data/####/tmp1661904884tmp (deleted)
/data/data/####/tmp1680761658tmp (deleted)
/data/data/####/tmp1722543010tmp
/data/data/####/tmp1722543010tmp (deleted)
/data/data/####/tmp1754974785tmp
/data/data/####/tmp1754974785tmp (deleted)
/data/data/####/tmp176906422tmp
/data/data/####/tmp176906422tmp (deleted)
/data/data/####/tmp1786027638tmp
/data/data/####/tmp1824125591tmp (deleted)
/data/data/####/tmp1824685571tmp
/data/data/####/tmp1824685571tmp (deleted)
/data/data/####/tmp188353193tmp
/data/data/####/tmp188353193tmp (deleted)
/data/data/####/tmp189874994tmp
/data/data/####/tmp189874994tmp (deleted)
/data/data/####/tmp1899576512tmp
/data/data/####/tmp1899576512tmp (deleted)
/data/data/####/tmp1917295216tmp
/data/data/####/tmp1917295216tmp (deleted)
/data/data/####/tmp1928624503tmp
/data/data/####/tmp1928624503tmp (deleted)
/data/data/####/tmp2061130723tmp
/data/data/####/tmp2061130723tmp (deleted)
/data/data/####/tmp2072996929tmp
/data/data/####/tmp2072996929tmp (deleted)
/data/data/####/tmp2077293744tmp
/data/data/####/tmp2077293744tmp (deleted)
/data/data/####/tmp2092582540tmp
/data/data/####/tmp2092582540tmp (deleted)
/data/data/####/tmp2094197621tmp
/data/data/####/tmp2094197621tmp (deleted)
/data/data/####/tmp2147253675tmp
/data/data/####/tmp2147253675tmp (deleted)
/data/data/####/tmp227226285tmp
/data/data/####/tmp227226285tmp (deleted)
/data/data/####/tmp273537360tmp
/data/data/####/tmp273537360tmp (deleted)
/data/data/####/tmp298107151tmp (deleted)
/data/data/####/tmp309177801tmp
/data/data/####/tmp310708965tmp
/data/data/####/tmp310708965tmp (deleted)
/data/data/####/tmp319797574tmp
/data/data/####/tmp319797574tmp (deleted)
/data/data/####/tmp345014621tmp
/data/data/####/tmp360349405tmp
/data/data/####/tmp360349405tmp (deleted)
/data/data/####/tmp362164777tmp
/data/data/####/tmp362164777tmp (deleted)
/data/data/####/tmp370636475tmp
/data/data/####/tmp370636475tmp (deleted)
/data/data/####/tmp384129053tmp
/data/data/####/tmp384129053tmp (deleted)
/data/data/####/tmp384608621tmp
/data/data/####/tmp384608621tmp (deleted)
/data/data/####/tmp38684000tmp
/data/data/####/tmp38684000tmp (deleted)
/data/data/####/tmp400766828tmp
/data/data/####/tmp400766828tmp (deleted)
/data/data/####/tmp401132788tmp
/data/data/####/tmp401132788tmp (deleted)
/data/data/####/tmp422699222tmp
/data/data/####/tmp422699222tmp (deleted)
/data/data/####/tmp44470558tmp
/data/data/####/tmp44470558tmp (deleted)
/data/data/####/tmp461916671tmp
/data/data/####/tmp461916671tmp (deleted)
/data/data/####/tmp482699555tmp
/data/data/####/tmp519046783tmp
/data/data/####/tmp519046783tmp (deleted)
/data/data/####/tmp535937949tmp
/data/data/####/tmp535937949tmp (deleted)
/data/data/####/tmp559873071tmp
/data/data/####/tmp595354362tmp
/data/data/####/tmp595354362tmp (deleted)
/data/data/####/tmp620577957tmp
/data/data/####/tmp620577957tmp (deleted)
/data/data/####/tmp64477501tmp
/data/data/####/tmp646987335tmp
/data/data/####/tmp683907336tmp
/data/data/####/tmp683907336tmp (deleted)
/data/data/####/tmp693541952tmp
/data/data/####/tmp693541952tmp (deleted)
/data/data/####/tmp709207500tmp
/data/data/####/tmp709207500tmp (deleted)
/data/data/####/tmp732891472tmp (deleted)
/data/data/####/tmp743842673tmp
/data/data/####/tmp743842673tmp (deleted)
/data/data/####/tmp763859927tmp
/data/data/####/tmp763859927tmp (deleted)
/data/data/####/tmp81043490tmp
/data/data/####/tmp81043490tmp (deleted)
/data/data/####/tmp828781128tmp
/data/data/####/tmp828781128tmp (deleted)
/data/data/####/tmp833833773tmp
/data/data/####/tmp833833773tmp (deleted)
/data/data/####/tmp835345353tmp
/data/data/####/tmp835345353tmp (deleted)
/data/data/####/tmp840497885tmp
/data/data/####/tmp840497885tmp (deleted)
/data/data/####/tmp861334244tmp
/data/data/####/tmp861334244tmp (deleted)
/data/data/####/tmp879864076tmp
/data/data/####/tmp879864076tmp (deleted)
/data/data/####/tmp886270503tmp
/data/data/####/tmp886270503tmp (deleted)
/data/data/####/tmp913454158tmp (deleted)
/data/data/####/tmp923485283tmp
/data/data/####/tmp923485283tmp (deleted)
/data/data/####/tmp933804688tmp
/data/data/####/tmp934204762tmp
/data/data/####/tmp934204762tmp (deleted)
/data/data/####/tmp955354172tmp
/data/data/####/tmp955354172tmp (deleted)
/data/data/####/tmp960744342tmp
/data/data/####/tmp960744342tmp (deleted)
/data/data/####/tmp967829478tmp (deleted)
/data/data/####/unipay.dex
/data/media/####/.tcookieid
/data/media/####/am
/data/media/####/compVersion
/data/media/####/verinfo.cfg

Miscellaneous:

Executes the following shell scripts:

chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
chmod 755 <Package Folder>/.platformcache/main.jar

Loads the following dynamic libraries:

libjiagu
libkxqpplatform
libme_unipay
libzvmhelper

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial